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Interposition-based system enhancements for multitiered servers are difficult to build 
because important system context is typically lost at application and machine 
boundaries. For example, resource quotas and user identities do not propagate 
easily ... 
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In many applications, wireless ad-hoc networks are formed by devices belonging to 
independent users. Therefore, a challenging problem is how to provide incentives to 
stimulate cooperation. In this paper, we study ad-hoc games--the routing and 
packet ... 
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Internet packet delivery policies have been of concern since the earliest times of the 
Internet, as witnessed by the presence of the Type of Service (ToS) field in the IPv4 
header. Efforts continue today with Differentiated Services (DiffServ) and 
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In an ad hoc wireless network where wired infrastructures are not feasible, energy 
and bandwidth conservation are the two key elements presenting challenges to 
researchers. Limited bandwidth makes a network easily congested by the control 
signals of ... 
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802.1 1 i is an IEEE standard designed to provide enhanced MAC security in wireless 
networks. The authentication process involves three entities: the supplicant (wireless 
device), the authenticator (access point), and the authentication server (e.g., a ... 
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Honeypots have been traditionally used to advertise dark address space and gather 
information about originators of traffic to such addresses. With simple thresholding 
mechanisms this technique has shown itself to be fairly effective in identifying 
suspicious ... 
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Today's HTTP carries Web interactions over client-initiated TCP connections. An 
important implication of using this transport method is that interception caches in the 
network violate the end-to-end principle of the Internet, which severely limits 
deployment ... 
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The Border Gateway Protocol (BGP) is the de facto interdomain routing protocol on 
the Internet. While the serious vulnerabilities of BGP are well known, no security 
solution has been widely deployed. The lack of adoption is largely caused by a 
failure ... 
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Stateful, in-depth, inline traffic analysis for intrusion detection and prevention is 
growing increasingly more difficult as the data rates of modern networks rise. Yet it 
remains the case that in many environments, much of the traffic comprising a high- 
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The sophistication and complexity of analysis performed by today's network intrusion 
prevention systems (IPSs) benefits greatly from implementation using general- 
purpose CPUs. Yet the performance of such CPUs increasingly lags behind that 
necessary to ... 
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Having timely and credible security information is becoming critical to network and 
security management. Most current sources of threat information and ... 
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This paper describes the design and implementation of protocol scrubbers. Protocol 
scrubbers are transparent, interposed mechanisms for explicitly removing network 
scans and attacks at various protocol layers. The transport scrubber supports 
downstream ... 
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A number of multi-hop, wireless, network programming systems have emerged for 
sensor network retasking but none of these systems support a cryptographically- 
strong, public-key-based system for source authentication and integrity verification. 
The traditional ... 
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Detecting anomalous traffic is a crucial part of managing IP networks. In recent 
years, network-wide anomaly detection based on Principal Component Analysis (PCA) 
has emerged as a powerful method for detecting a wide variety of anomalies. We 
show that ... 
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This paper focuses on BGP communities, a particular BGP attribute that has not yet 
been extensively studied by the research community. It allows an operator to group 
destinations in a single entity to which the same routing decisions might be 
applied. ... 
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Launching a denial of service (DoS) attack is trivial, but detection and response is a 
painfully slow and often a manual process. Automatic classification of attacks as 
single- or multi-source can help focus a response, but current packet-header- 
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Ah hoc networks offer increased coverage by using multihop communication. This 
architecture makes services more vulnerable to internal attacks coming from 
compromised nodes that behave arbitrarily to disrupt the network, also referred to as 
Byzantine ... 
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